Posit bug bounty programs

Posit programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
R/ RStudio / Posit OSS Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• R/

  RStudio / Posit OSS

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://posit.co

  Web

• Cross-user isolation on a shared server: file access, project handling, session listing and anything else where one account's request can name another account's resource

  Products and areas

• Positron, its extension host and the parts inherited from an editor architecture that loads and runs extension code

  Products and areas

• Quarto in full: .qmd parsing, the Pandoc invocation, the embedded execution engines for knitr and Jupyter, project and metadata YAML handling, extensions, and the shipped output templates

  Products and areas

• RStudio Server in full: the HTTP server, the sign-in flow, session cookies and CSRF protection, and the authorisation checks in front of every endpoint

  Products and areas

• Shiny end to end, in both the R and Python implementations: the WebSocket protocol between browser and server, input coercion into R or Python evaluation contexts, reactive state, file upload and download handlers, bookmarking and session state

  Products and areas

• The published policy asks for a report on a vulnerability in any Posit product, by email with PGP or through a repository advisory, and draws no boundary narrower than the product set. This card covers the open-source four: the RStudio IDE, Shiny, Quarto and Positron

  Products and areas

• The R and Python package installation and dependency resolution paths any of these tools trigger on a user's behalf

  Products and areas

• The rsession process model and the boundary between a user's session and the server process that launched it, including how a session is spawned, which identity it runs as, and what it inherits

  Products and areas

• The RStudio file surface: upload, download, the file browser, the terminal, and the R console itself

  Products and areas

• The RStudio IDE front end, covering rendered R output, Markdown and notebook previews, the built-in viewer pane, and every place server-supplied content becomes HTML

  Products and areas

• The Shiny UI layer, including every place user input reaches rendered HTML, and the static asset handling behind an app

  Products and areas

No target matches. Try part of a host name, such as the company name.